The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Execute SOAR playbooks from Trellix ESM

Published on Sep 12, 2026

1 minute(s) read

You can execute the SOAR playbooks from Trellix ESM and view the executed playbook details in Trellix Security Orchestrator and respond to the incidents.

Make sure the Device Actions privilege is enabled from System Properties.

From the Trellix ESM dashboard, click and select More Settings.
Select Event Views → Event Analysis, then select an event.
Click and select Actions → Execute SOAR Playbook.
Select Prepare Playbook and click Execute.
In the SOAR Response pop-up window, click SOAR Response.

The SOAR playbook is executed successfully.

:

Was this article helpful?